93% website apps vulnerable after 'fixing'.

Nebulas Security have announced the results of further research from its partner Impervals Application Defence Centre report, 'How safe is it out there' Based on a four-year study into the vulnerability of public and private web applications, a key section of the report asserts that periodic Penetration testing alone is not an effective means of reducing risks associated with web-enabled applications. Analysis of penetration retest data shows that despite periodic penetration testing and subsequent 'fixes' the inherent risk to an application does not decrease, but remains constant and may even increase over time. The retests conducted by Imperva's Application Defence Centre (ADC) revealed that 'high' or 'critical' vulnerabilities in applications actually increased Application Defence Centre (ADC) revealed that 'high' or 'critical' vulnerabilities in applications actually increased from 89% to 93% after first time tests. In more than 500% of the retests, completely new categories of vulnerabilities appeared.

The report offers multiple explanations for these findings:

* After penetration testing developers did not fix the identified vulnerabilities either because they did not know how to fix them, or because they ignored the results of the test.

* Developers introduced new vulnerabilities during the time between tests--either as part of the normal evolution of the website, or as part of an attempt to fix vulnerabilities identified during the penetration test.

* With additional time and the experience of the first test, the penetration testing team was able to find additional vulnerabilities that existed but were undetected during the first test.

Comment:

Secunty-minded software development and diligent testing of applications are necessary components to address compounding application vulnerabilities. However, to actually improve security over time, organisations need to deploy application security solutions end continue to use penetration testing to measure their efforts.

Application-level attacks on the rise

Application-level vulnerabilities leave the door open to costly external web attacks, internal database breaches and worms. Comment:

"Application-level security threats continue to rise steadily in terms of volume and impact" said META Group provider of information technology research, advisory services, end strategic consulting. "Relying solely on software vendors to fix related vulnerabilities is a flawed strategy, particularly as the time the bad guys take to develop their attacks is clearly shrinking. The result is the need for controls that provide protection not only at the application layer, but also on a continuous, always-on basis."

The study detailed in this report, which ran from 2000-2003, summarises the analysis of over 300 application penetration tests of public and private sector web applications. This resulting white paper provides unique insights into the frequency, types, risk and consequences of vulnerabilities that exist across the test group of financial, government, telecommunications and information technology organisations. The report can be downloaded from:

http://www.imperva.com/application_defensecenter /papgrs/how_safe_is_it.html